Making frontier cybersecurity capabilities available to defenders

Source: Anthropic Date: 2026-02-20 URL: https://www.anthropic.com/news/claude-code-security

Summary

Anthropic launched Claude Code Security, a limited research preview that identifies software vulnerabilities via reasoning-based analysis (not pattern matching). Scans codebases, suggests patches for human review, routes findings through multi-stage verification to a dashboard. Claimed Opus 4.6 found “over 500 vulnerabilities” in production open-source repositories. Enterprise and Team customers get access immediately; expedited access for open-source maintainers.

Implications

• Claude Code / security thread. Vulnerability detection as a Claude Code feature is a direct play against Semgrep, Snyk, and GitHub’s native security tools — but using LLM reasoning rather than rules-based scanning. The 500+ vulnerabilities in open-source production repos is the credibility claim; whether those are novel finds or known CVEs matters.
• “Defenders not attackers” framing. Positioning the tool explicitly for defenders while noting “AI-enabled cyber threats” is increasing is the messaging Anthropic needs to deploy this without triggering the RSP’s concerns about offensive cyber uplift. The multi-stage verification before dashboard presentation is the safeguard.
• Research preview as gated rollout. Limited research preview is Anthropic’s pattern for high-risk capabilities — same approach as Claude Code’s initial launch, computer use, and agentic features. It lets them gather safety data before broad access.
• Enterprise + open-source maintainers. Targeting both enterprise customers and OSS maintainers simultaneously covers the two most security-sensitive deployment contexts. OSS maintainers are a high-leverage target — fixing a vulnerability in a foundational library has outsized impact.
• Watch: whether the 500+ vulnerability finding is independently verified; how false-positive rates compare to rules-based scanners; whether the tool gets used offensively despite defender framing; GA timeline.